Add audited user report deletion

apps/api/tests/test_api.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from datetime import datetime, timedelta, timezone
+from uuid import UUID
 
 from fastapi.testclient import TestClient
 from sqlalchemy import create_engine
@@ -9,7 +10,7 @@ from sqlalchemy.pool import StaticPool
 
 from app.database import Base, get_session
 from app.main import app
-from app.models import Bait, BaitKind, CatchReport, Fish, ImportStatus, ModerationStatus, OfficialRecordImport, SourceType, Spot, Waterbody
+from app.models import Bait, BaitKind, CatchReport, Fish, ImportStatus, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, Waterbody
 
 
 engine = create_engine("sqlite://", connect_args={"check_same_thread": False}, poolclass=StaticPool)
@@ -122,3 +123,27 @@ def test_pending_report_accepts_one_validated_screenshot(monkeypatch) -> None:
     assert response.status_code == 204
     duplicate = client.post(f"/api/v1/catch-reports/{created['id']}/screenshot", files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")})
     assert duplicate.status_code == 409
+
+
+def test_admin_delete_anonymizes_report_removes_screenshot_and_keeps_audit(monkeypatch) -> None:
+    created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 93, "y": 94, "weight_g": 4300, "player_name": "Private Player", "source_url": "https://example.test/private", "comment": "private comment"}).json()
+    with Session(engine) as db:
+        report = db.get(CatchReport, UUID(created["id"]))
+        report.screenshot_key = "reports/private.jpg"
+        db.commit()
+    deleted_keys: list[str] = []
+    monkeypatch.setattr("app.main.delete_screenshot", deleted_keys.append)
+    headers = {"Authorization": "Bearer change-me-in-production"}
+    response = client.delete(f"/api/v1/admin/catch-reports/{created['id']}", headers=headers)
+    assert response.status_code == 204
+    assert deleted_keys == ["reports/private.jpg"]
+    with Session(engine) as db:
+        report = db.get(CatchReport, UUID(created["id"]))
+        assert report.deleted_at is not None
+        assert report.moderation_status == ModerationStatus.rejected
+        assert report.player_name is None and report.source_url is None
+        assert report.screenshot_key is None and report.raw_payload is None
+        event = db.query(ModerationEvent).filter_by(catch_report_id=report.id).order_by(ModerationEvent.created_at.desc()).first()
+        assert event is not None
+        assert event.reason == "user report deleted and anonymized"
+    assert client.delete(f"/api/v1/admin/catch-reports/{created['id']}", headers=headers).status_code == 404